Release Notes

6.4.1

Splunk Enterprise 6.4.1 was released on May 18, 2016.

The following issues have been resolved in this release. For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.

Saved search, alerting, scheduling, and job management issues

Publication date	Defect number	Description
2016-04-22	SPL-117301	Name of scheduled PDF report changed to lowercase.
2016-04-22	SPL-117277	UI does not pass the app name in the back end request for alert actions.
2016-04-22	SPL-115720	Email Alerts: 'null' password gets hashed & breaks email alerts.
2016-04-22	SPL-115964	tstats command inside appendcols returns zero results.
2016-04-12	SPL-115991	Event summary dialog of the add data page shows -1 as events count while uploading the data.

Data input issues

Publication date	Defect number	Description
2016-04-22	SPL-116478	Setting recursive=false on a monitor stanza which has a direct subdirectory that has its own monitor stanza will prevent the subdirectory from being monitored
2016-04-12	SPL-117328	Some csv files are re-indexed upon restarting the Indexer.

Splunk Web and interface issues

Publication date	Defect number	Description
2016-04-22	SPL-116263	German dropdowns for Alert Expiration have incorrect wording.
2016-04-15	SPL-116930	The report "save as report" and "edit search" dialogs allow to accelerate a search that uses macros, eventtypes or tags even though we do not fully support that.
2016-04-13	SPL-116944	Scheduled searches with _accelerate in the search query are not visible in the job_management page.
2016-04-12	SPL-117139	HTTPS_PROXY environment variable set causes 500 Internal Server Error after login.
2016-04-12	SPL-117217	When using appServerPorts = 0 and SSL, Splunkweb will not start.

Distributed deployment, forwarder, deployment server issues

Publication date	Defect number	Description
2016-05-17	SPL-119998	Universal Forwarder exceeds throughput limits - maxKBps not honored.
2016-05-13	SPL-118661	Forwarding to both standalone and indexerDiscovery, only cluster peers have data, nothing on standalone server.
2016-04-21	SPL-118187	Universal Forwarder stops sending events due to TCP failover.
2016-04-20	SPL-118095	Forwarder Management Add data - Unable to add inputs with unique serverclasses and same sourcepath.
2016-04-20	SPL-114320	Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload.

Data model and pivot issues

Publication date	Defect number	Description
2016-04-22	SPL-115964	tstats command inside appendcols returns zero results.
2016-04-12	SPL-115321	Filter dropdown in pivot ignores the timerange settings while dispatching a search

PDF issues

Publication date	Defect number	Description
2016-05-04	SPL-116819	The title of the dashboard panel is rendered on a different page when at least one panel has different height as compared to other panels in the exported pdf.
2016-04-12	SPL-115083	Exported pdf shows "year=1 is before 1900; the datetime strftime() methods require year >= 1900" error message when the last row of table does not contain any value for _time column.

Admin and CLI issues

Publication date	Defect number	Description
2016-04-24	SPL-115715	(Splunk CLI option '-output csv' does not retain the field ordering.
2016-04-22	SPL-117233	Check-path and rename-source throwing invalid key errors.
2016-04-20	SPL-114320	Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload

Security issues

Publication date	Defect number	Description
2016-05-17	SPL-112718	Missing SAMEORIGIN headers on specific redirects.

For a list of security issues, please see the Security Advisory. A list of all recent advisories can be found in the Security Portal.

Distributed search and search head clustering issues

Publication date	Defect number	Description
2016-05-09	SPL-119735	SHC members do not always restart properly after bundle push.
2016-05-03	SPL-118683	Summary index does not populate due to race condition between Tailing and Summary search.
2016-04-22	SPL-116741	Hanging search processes using all available CPUs on the search head.
2016-04-20	SPL-116959	Unable to find existing bundles and thereby required full replications instead every time.
2016-04-19	SPL-118107	Search head cluster captain refuses connections from other SHC members including itself resulting in all scheduled searches stopping.
2016-04-13	SPL-116942	SHC: loadjob fails if the savedsearch name contains spaces.

Indexer and indexer clustering issues

Publication date	Defect number	Description
2016-04-28	SPL-115121	Crash in PipelineInputChannel::setIndexedExtractionsDestructive on 6.2.6.
2016-04-25	SPL-118720	Events sent to non-existent index cause ERROR EAIOutParameters - invalid entry title in toAtom(): INDEXER_MISSING_INDEX.
2016-04-22	SPL-115554	Index reload failing because of trailing slash in path inside indexes.conf.
2016-04-19	SPL-117258	Crashing thread: indexerPipe when index is readOnly.
2016-04-18	SPL-115946	tstats not honoring earliest/latest and providing diff results depending on Time Picker in index clustering.

Charting, reporting, and visualization issues

Publication date	Defect number	Description
2016-05-10	SPL-117990	Single value on a long timechart resultset will truncate the results and not display the last value.
2016-04-13	SPL-117655	On iOS devices, the column and bar charts are rendered with an extra tick.
2016-04-12	SPL-114442	When a dashboard containing extension scripts and stylesheets from other app context is cloned, the cloned dashboard does not contain the extension scripts and stylesheets.

Unsorted issues

Publication date	Defect number	Description
2016-05-13	SPL-116611	Only having a Mint license without an Enterprise license crashes searches.
2016-05-02	SPL-119320	Upgrading indexer 6.3.3 to 6.4 fails to generate audit keys.
2016-04-22	SPL-114479	Misleading, non-actionable messaging when a license slave cannot connect to a license master because of mismatched pass4SymmKeys.
2016-04-22	SPL-117339	Universal Forwarder fails to install on Windows7 workstations via SCCM
2016-04-21	SPL-114637	Crash in Paginator::cmp for thread TcpChannelThread.
2016-04-20	SPL-118123	App Install Failing On Windows ( Error installing application: Failed to copy ).
2016-04-20	SPL-116079	Unable to append to KV Store.
2016-04-19	SPL-118193	Diag fails when duplicate apps exist in peer-apps, apps or a search head pool; diag warns about duplicate app & skipping, but still fails w/stack trace.
2016-04-14	SPL-117865	JsonStreamingParser crashed in SearchResultsInfo::fromSearchResults.

Search issues

Publication date	Defect number	Description
2016-05-13	SPL-116611	Only having a Mint license without an Enterprise license crashes searches.
2016-04-25	SPL-115934	Incorrect backslash expansion for props.conf source:: stanzas.
2016-04-24	SPL-115715	Splunk CLI option '-output csv' does not retain the field ordering.
2016-04-22	SPL-118570	Joining several loadjob commands in a search fails to find artifacts in Search Head Cluster.
2016-04-21	SPL-116965	The search returns different results when the user switches Preview/No Preview settings
2016-04-21	SPL-118163	Distributed Search Groups not honored when using | tstats command.
2016-04-18	SPL-115946	tstats do not honor earliest/latest and providing diff results depending on Time Picker in index clustering.
2016-04-18	SPL-116878	Wrong results from a search containing a very large number of results that have the same timestamp.
2016-04-15	SPL-116930	The report "save as report" and "edit search" dialogs allow to accelerate a search that uses macros, eventtypes or tags even though we do not fully support that.
2016-04-13	SPL-116944	scheduled searches with _accelerate in the search query are not visible in the job_management page.
2016-04-12	SPL-116060	Visualization tab shows warning messages which are already in the job dropdown.
2016-04-12	SPL-117139	HTTPS_PROXY environment variable set causes 500 Internal Server Error after login.